raccoon | 46a64c9b4e35bc66a5dcb7581d6099aef0d8d87e8a0ff4f2f85ae7e0e21e4bb9

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 20:50

Target

ef7a87e5e19c621e141bde5eb4ab8e7f_JaffaCakes118.exe
Size

422KB
MD5

ef7a87e5e19c621e141bde5eb4ab8e7f
SHA1

c1996fe2f19588c02c4b0094824197784cf66f61
SHA256

46a64c9b4e35bc66a5dcb7581d6099aef0d8d87e8a0ff4f2f85ae7e0e21e4bb9
SHA512

81a16522e264dfee7976eb232d4af962b4413c5f4c8f3209c04e9ea5cd963168a1f985006ab9f87ef10496d60c6260838b894dd64de8f8f00551daeb51620177
SSDEEP

12288:3bak5+U5Q4J9SBRE7VHHHKv0eNq8FTEc:3mk55moyi7FH6Z

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral2/memory/2148-2-0x0000000003B00000-0x0000000003B8F000-memory.dmp	family_raccoon_v1
behavioral2/memory/2148-3-0x0000000000400000-0x0000000001DB7000-memory.dmp	family_raccoon_v1
behavioral2/memory/2148-4-0x0000000000400000-0x0000000001DB7000-memory.dmp	family_raccoon_v1
behavioral2/memory/2148-7-0x0000000003B00000-0x0000000003B8F000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

pid	pid_target	Process	procid_target
4648	2148	WerFault.exe	90
2016	2148	WerFault.exe	90
4908	2148	WerFault.exe	90
1624	2148	WerFault.exe	90
1480	2148	WerFault.exe	90
4140	2148	WerFault.exe	90

C:\Users\Admin\AppData\Local\Temp\ef7a87e5e19c621e141bde5eb4ab8e7f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef7a87e5e19c621e141bde5eb4ab8e7f_JaffaCakes118.exe"
1⤵
PID:2148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 740
  2⤵
  - Program crash
  PID:4648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 760
  2⤵
  - Program crash
  PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 888
  2⤵
  - Program crash
  PID:4908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 860
  2⤵
  - Program crash
  PID:1624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 956
  2⤵
  - Program crash
  PID:1480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1128
  2⤵
  - Program crash
  PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2148 -ip 2148
1⤵
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2148 -ip 2148
1⤵
PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2148 -ip 2148
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2148 -ip 2148
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2148 -ip 2148
1⤵
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2148 -ip 2148
1⤵
PID:1336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:4372

memory/2148-1-0x0000000001E40000-0x0000000001F40000-memory.dmp

Filesize
1024KB

Download
memory/2148-2-0x0000000003B00000-0x0000000003B8F000-memory.dmp

Filesize
572KB

Download
memory/2148-3-0x0000000000400000-0x0000000001DB7000-memory.dmp

Filesize
25.7MB

Download
memory/2148-4-0x0000000000400000-0x0000000001DB7000-memory.dmp

Filesize
25.7MB

Download
memory/2148-6-0x0000000001E40000-0x0000000001F40000-memory.dmp

Filesize
1024KB

Download
memory/2148-7-0x0000000003B00000-0x0000000003B8F000-memory.dmp

Filesize
572KB

Download